Skip to content
Szenera DeveloperDocs
API › Error codes › Error codes: organization, access, joining
Chapters

Error codes: organization, access, joining

The codes of the areas Tenancy, Access, Onboarding, and Cloud-Connections: master data, domain, roles, grants, registration, storage connections.

8 minute readAPIUpdated: 10/25/2026

On this page

Before you start

For
Anyone who works with the organization, roles, invitations, or storage connections through the API.
Prerequisite
know the error format — see The error format

The codes of the Tenancy, Access, Onboarding, and Cloud-Connections areas: master data and brand of the organization, custom domain, company sign-in, roles and grants, invitations, sign-up, join requests, and storage connections.

How to read the tables

Read the tables like this: Code is the value of the code field in the error body. Your logic switches on it, never on message. Meaning and Typical trigger classify the case. HTTP is the status actually sent. Expected reaction is your client’s response, drawn from a fixed vocabulary that is the same on all seven error-code pages: “check credentials” (401), “check permission or package” (402, 403), “correct the input” (400, 413, 415, 422), “reload, resend” (version conflicts), “do not retry, check the operation” (404, 409, 410, 426), “wait (Retry-After)” (429), and “retry later, report the trace ID if it recurs” (5xx).

The codes

Organization (Tenancy)

Master data, brand, address, company sign-in including its domains, and the portal’s own address. Tenant.Frozen (403) blocks changes while a payment is outstanding. Reading and billing stay open.

Code Meaning Typical trigger HTTP Expected reaction
Tenant.NotFound Organization not found Unknown ID of the organization 404 do not retry, check the operation
Tenant.SlugAlreadyExists Short name already taken Creation with a short name that is already in use 409 do not retry, check the operation
Tenant.SlugReserved Short name reserved Reserved short name 422 correct the input
Tenant.InvalidStatusTransition Invalid status change of the organization Disallowed status change 409 do not retry, check the operation
Tenant.Frozen Organization frozen Change while a payment is outstanding. Reading and billing stay open 403 check permission or package
Tenant.DeleteConfirmationRequired Deletion requires confirmation Deletion without confirmation 422 correct the input
Branding.ContrastInsufficient Contrast insufficient Color choice falls below the minimum contrast 422 correct the input
Branding.AssetNotFound Brand mark missing Reference to an unknown logo/favicon 422 correct the input
Address.InvalidCountryCode Country code invalid Unknown ISO country code 422 correct the input
Sso.ConfigInvalid Company sign-in configuration invalid Malformed company sign-in fields, or the issuer does not respond with a valid provider description 422 correct the input
Sso.DefaultRoleInvalid Default role invalid The default role of the sign-in method is unknown or belongs to a different organization 422 correct the input
Sso.ProviderNotFound Sign-in method not found Management call with an unknown provider ID 404 do not retry, check the operation
Sso.DomainNotFound Company sign-in domain not found Verifying or withdrawing a domain that this provider does not claim 404 do not retry, check the operation
Sso.DomainAlreadyClaimed Company sign-in domain already claimed The domain already belongs to another sign-in method platform-wide 409 do not retry, check the operation
Sso.DomainNotVerified Company sign-in domain not verified Action requires a confirmed domain 409 do not retry, check the operation
Sso.EnforcementNotVerified Enforcement without fresh proof Switching on without a successful test sign-in through this provider in the last 15 minutes 422 correct the input
Sso.BreakGlassInvalid Break-glass account not permitted More than two accounts, an unknown account, or one without a second factor 422 correct the input
CustomDomain.AlreadyTaken Domain already taken Domain already used by another organization 409 do not retry, check the operation
CustomDomain.VerificationPending Domain verification pending Use before the DNS record is verified 409 do not retry, check the operation

Roles and grants (Access)

Roles, grants, and permission keys. Built-in roles are immutable. A role can never carry permissions that the acting person does not have.

Code Meaning Typical trigger HTTP Expected reaction
Role.NotFound Role not found Unknown role ID 404 do not retry, check the operation
Role.BuiltInImmutable System role immutable Change to a built-in role 409 do not retry, check the operation
Role.InUse Role in use Deleting a role that someone still holds or that a sign-in method uses as its default 409 do not retry, check the operation
Role.PermissionNotInCatalog Permission not in the catalog Role with an unknown permission key 422 correct the input
Role.PermissionEscalationBlocked Permissions beyond your own set Role with permissions that the acting person does not hold 403 check permission or package
Grant.NotFound Grant not found Unknown grant ID 404 do not retry, check the operation
Grant.AllowDenyConflict Allow-deny conflict Contradictory grant rules 422 correct the input
Grant.ResourceNotOwned Resource not owned Grant on a resource that belongs to someone else 403 check permission or package
PermissionKey.InvalidSyntax Permission key malformed Malformed permission key 422 correct the input

Invitations and sign-up (Onboarding)

Invitations, setup wizard, creation of an organization, self sign-up, and join requests. Two deviations from the area rule are intentional: Signup.TicketInvalid answers 401 because the ticket is the proof, and Signup.Disabled answers 403, since the switch-off takes effect only where a ticket exists. Sign-up deliberately reveals nothing about what exists: an unknown, a used, and an expired confirmation code all answer identically with Signup.TicketInvalid.

Code Meaning Typical trigger HTTP Expected reaction
Invitation.NotFound Invitation not found Unknown invitation ID 404 do not retry, check the operation
Invitation.TokenInvalid Invitation token invalid Malformed token 400 correct the input
Invitation.Expired Invitation expired Expired token 410 do not retry, check the operation
Invitation.AlreadyAccepted Invitation already accepted Duplicate acceptance 409 do not retry, check the operation
Invitation.Revoked Invitation revoked Redeemed but revoked invitation 410 do not retry, check the operation
Invitation.RoleNotInTenant Role not in the organization Invitation with a role of another organization 422 correct the input
SetupStep.Unknown Setup step unknown Invalid step of the setup wizard 422 correct the input
Provisioning.SagaFailed Creation of the organization failed Error in the multi-step creation of an organization 500 retry later, report the trace ID if it recurs
Provisioning.OwnerEmailAlreadyExists Owner’s address taken Creating an organization with an address that is already in use 409 do not retry, check the operation
Signup.Disabled Self sign-up switched off The operator has the platform switch turned off while a sign-up is being continued 403 check permission or package
Signup.TicketInvalid Confirmation code or ticket invalid Unknown, used, or expired code — all three answer the same 401 check credentials
Signup.DomainClaimedBySso Domain belongs to a company sign-in method Completing the creation of a new organization although the routing result was sso 409 do not retry, check the operation
Signup.JoinRequired Organization for this domain already exists Completing the creation of a new organization although the routing result was join 409 do not retry, check the operation
Signup.OrganizationNotEligible Organization not selectable Join request to an organization outside the ticket’s set 403 check permission or package
JoinRequest.NotFound Join request not found Unknown ID or request of a different organization 404 do not retry, check the operation
JoinRequest.AlreadyDecided Join request already decided Second decision on the same (no longer open) request 409 do not retry, check the operation

Storage connections (Cloud-Connections)

The authorizations on third-party storage accounts, from which the media library draws its places. The 409 codes share one message: the connection exists, but its state does not hold up, and the answer is a new round trip, not troubleshooting.

Code Meaning Typical trigger HTTP Expected reaction
CloudConnection.NotFound Connection not found Disconnecting, repairing, or fetching a token with an unknown or foreign connection ID — a foreign ID and an invented one are deliberately indistinguishable 404 do not retry, check the operation
CloudConnection.ProviderUnavailable Provider not set up Connecting to a storage provider for which this deployment has no configuration stored 404 do not retry, check the operation
CloudConnection.StateInvalid Callback state unknown The callback carries no state that this server started: unknown, expired, or already redeemed — all three answer the same 401 check credentials
CloudConnection.CallbackFailed Callback without authorization Code exchange failed, the provider grants no offline access, or the account lookup failed 401 check credentials
CloudConnection.AccountMismatch A different account came back A repair round trip that signs in with a different account than the connection’s. An error of its own instead of silently creating a new entry — otherwise two entries would exist, one of which would never work again 409 do not retry, check the operation
CloudConnection.Broken Authorization no longer holds The provider rejects the authorization. Only a new round trip makes the connection usable again. The media library raises this code too, so that the portal builds the same button in one place 409 do not retry, check the operation
CloudConnection.Revoked Connection disconnected Accessing, refreshing, or repairing a disconnected connection — its secret is deleted, so there is nothing left to refresh 409 do not retry, check the operation

Count

This page lists 51 codes. Together with the other six error-code pages this gives 493 domain codes (4xx) and 119 server errors (5xx), 612 codes in all — the complete catalog of the platform.